Skip to content

Manual

hv version 0.0.0

Networking

A Network connects VM interfaces. External Networks use the Pool's physical connectivity; a VPC provides a Project's private layer-2 overlay between Hosts. Before changing either, identify the management path, switch configuration, required MTU and the service that supplies VM addressing. Keep Host console access when altering physical connectivity.

Create a VPC

Use a VPC when VMs need a private Network within one Pool. Creating it supplies connectivity, not an IP subnet manager, DHCP server, router, NAT or floating IP service.

  1. Open the Project's VPCs and choose New VPC.
  2. Enter Name, Description and Pool.
  3. Under Advanced, review Encapsulation and MTU. GRE and VXLAN are offered.
  4. Select Create VPC.
  5. Attach VM NICs from the VM's Networking tab or select the VPC during VM creation.

The External networks section shows physical Networks available to the Silo. A Fleet administrator manages their visibility at System, Networks. Do not bridge a VM onto a provider's public Network unless the provider permits its MAC and addressing.

Connect two guests on a private network

For example, create app-net in production and select it for web-01 and a second test VM, web-02. Both VMs must use that Project's VPC in the selected Pool. Before configuring addresses, check that their virtual NICs are actually attached to app-net; similarly named external Networks are different objects.

Inside the guests, configure unused addresses such as 10.0.0.21/24 and 10.0.0.22/24. These values illustrate a private subnet and must fit your own addressing plan. Address configuration belongs to the guest or its provisioning process. Entering a VPC name in hv does not create a DHCP lease, and entering an address inside one guest does not configure the other.

Check communication between the guests using a service that is listening and allowed by their operating-system firewalls. If they can communicate with each other but not the internet, inspect the intended external path. That result alone does not indicate a broken VPC. A guest needs suitable routing and an external connection for destinations beyond this private Network.

If communication fails between Hosts but works when both guests are on one Host, inspect overlay reachability and MTU across the participating Hosts. Keep the original VM and VPC identifiers while investigating. The monitoring chapter helps distinguish a missing Host observation from a complete view of the Network.

Apply firewall rules

A VPC's Firewall rules tab filters traffic to or from its NICs. Choose New rule, specify priority, action, direction, address family, protocol, addresses, ports and the NIC scope, then create the rule. Higher priority wins. Rules are stateless and unmatched traffic is allowed: an allow rule alone does not create a default-deny policy.

Account for both directions and both IP families. An IPv4 denial does not deny IPv6. Test allowed and denied connections from the VMs after applying changes. The CLI hv net sdn acl set replaces the entire ruleset, so retain every rule you intend to keep rather than sending only the edited entry.

For web-01, begin with a specific traffic requirement, such as allowing an application connection from web-02. Identify the source address, destination port and direction before creating a rule. Because unmatched traffic is allowed, adding that permission alone does not exclude other sources. Design any broader denial together with its higher-priority exceptions, and account for return traffic because rules are stateless.

After saving, test the permitted connection and a connection that should be refused. Also test IPv6 if the guests use it. If the application stops responding unexpectedly, review the last rule change and its scope before changing the guest's address or replacing its NIC. Preserve the full intended ruleset when using the replacement command in the CLI reference.

Manage external Networks

Fleet administrators can inspect Networks and create supported VLAN, bond or SR-IOV configurations. The CLI exposes these operations, with details in the reference:

hv net list --pool POOL
hv net show NETWORK --pool POOL
hv net create --pool POOL --name isolated --mtu 1500

A Network without an uplink does not acquire external routing. Bond members must be eligible physical PIFs on one Host, and the switch must match the selected mode. SR-IOV needs an active IOMMU and PV dom0. Check PIF attachment and VM connectivity after changes.

Understand the pool mesh

Public-profile Hosts use the WireGuard Pool mesh, hvmesh0. Agents publish their mesh identity and reconcile peers. Once every Host has published, LINSTOR, DRBD and VPC tunnels use mesh addresses. Configure replicated storage after that state is established. hv-agent mesh status reports peers and handshake information.

Ordinary mesh operation leaves xapi and live migration on the management address. An additional, explicit installer setting, [mesh] management = "netdevsim" or "vlan", puts xapi management on a mesh-addressed PIF. This is public-profile-only and is not the default answer setting. The Host console refuses ordinary management-address editing in this mode. Do not apply ordinary interface-editing advice to it.

The optional hvadmin0 link provides operator access independent of the dashboard. Treat its peer configuration as private and maintain it through the Host's supported mesh commands.

Edge and connection problems

Do not transfer the Host's only public NIC to an Edge appliance. Public-NIC handover is not available as a complete administration workflow in this release. Keep management connectivity on the installed Host and arrange VM external connectivity separately. The public installation profile does not create a router for a Project VPC.

For partial overlay provisioning, inspect Host and agent reachability, mesh status and MTU before requesting Resync overlay with a Fleet role. Repeatedly creating replacement VPCs can obscure the original error. A VPC with attached NICs cannot be deleted; detach or move those NICs first.